What does ramon (TopN mode) actually do?

[Carter Bullard]

Hey Andrew,
   So I've got it done for the most part.  The mode is
called "HostP" for host protocol.  "HostP" and "TopN"
are directly comparable, and you can run "HostP"
and "Net/n" together to get your network protocol
breakdowns.  

   There is only one 'gottcha' in that sorting the
output does not currently group multiple protocol
entries for the same address together, as its trying
to sort based on packet or byte counts. You may have
to post process the output to do a more elaborate
sorting.

   I have to do some more testing, but I'll try
to have it up on the server tomorrow.  If not then,
it will have to wait until after the holiday
weekend.

Hope all is well!!


Carter

Carter Bullard
QoSient, LLC
150 E. 57th Street Ste 12D
New York, New York 10022-2795

+1 212 588-9133 Phone
+1 212 588-9134 Fax

> -----Original Message-----
> From: Andrew Pollock [mailto:andrew-argus at andrew.net.au] 
> Sent: Tuesday, July 01, 2003 11:59 PM
> To: Carter Bullard
> Cc: argus-info at lists.andrew.cmu.edu
> Subject: Re: What does ramon (TopN mode) actually do?
> 
> 
> On Tue, Jul 01, 2003 at 11:38:41AM -0400, Carter Bullard wrote:
> > Hey Andrew,
> >    It's easy to get the data to agree, it's just you
> > have to make sure that you know what you're asking for
> > so you can get the filtering right.  But I think that
> > there is still some confusion.  While ramon() does
> > generate valid argus output, you can't take the output
> > of a Svc run and then process it to get a TopN report,
> > as the models are not compatible.  The keys that each
> > are using to do the aggregation are not comparable from
> > a relational algebraic perspective.  Its like trying
> > to count the number of tennis shoes from a set of data
> > that reference only the color of pants in a group.
> 
> I understand the "apples and oranges" factor of what I'm trying to do.
>  
> >    If you want ramon() to provide you with an interface
> > oriented breakdown by protocol for each address, we
> > can add that ramon() without any trouble.  Just need
> > come up with a name for the mode and I'll whip it up in
> > an hour or so.
> 
> You're most kind. I need to be able to do it on a per address 
> and a per 
> net basis.
> 
> Andrew
>